Ecommerce

// lib/purchase.ts — app-owned workflow; no server credential or PSP SDK.
import {
  createClient,
  createProductSelectionCodec,
  resolveProductSelection,
} from '@01.software/sdk'

type Commerce = ReturnType<typeof createClient>['commerce']
type Cart = Awaited<ReturnType<Commerce['carts']['retrieve']>>
type Checkout = Awaited<ReturnType<Commerce['checkouts']['retrieve']>>
type Payment = Awaited<
  ReturnType<Commerce['paymentSessions']['retrievePortOne']>
>
type StandardAction = Extract<
  NonNullable<Payment['nextAction']>,
  { type: 'portone_sdk' }
>
// Exactly the PortOne Browser SDK V2 requestPayment() fields.
export type PortOnePaymentRequest = Pick<
  StandardAction,
  | 'storeId'
  | 'channelKey'
  | 'paymentId'
  | 'orderName'
  | 'totalAmount'
  | 'currency'
  | 'payMethod'
  | 'redirectUrl'
>
type Saved<Request, Result> = { request: Request; result?: Result }

export type PurchaseRecord = {
  authorityId: string
  purchaseId: string
  // Immutable after the app atomically creates this session-bound record.
  intent: {
    slug: string
    selectionQuery: string
    market: string
    email: string
    quantity: number
  }
  cartCreationStarted?: true
  cart?: { cartToken: string; snapshot: Cart }
  add?: Saved<
    Parameters<Commerce['carts']['addItem']>[0],
    Awaited<ReturnType<Commerce['carts']['addItem']>>
  >
  update?: Saved<
    Parameters<Commerce['carts']['updateItem']>[0],
    Awaited<ReturnType<Commerce['carts']['updateItem']>>
  >
  checkout?: Saved<
    Parameters<Commerce['checkouts']['create']>[0],
    Awaited<ReturnType<Commerce['checkouts']['create']>>
  >
  payment?: Saved<
    Parameters<Commerce['paymentSessions']['createPortOne']>[0],
    Payment
  >
}

// Implement using the EXISTING app's durable purchase/session store.
// exclusive authenticates authorityId, checks record ownership, and serializes
// all tabs/workers for this purchase. save commits a detached durable snapshot
// before resolving; it is fenced against expired ownership and older revisions.
// A failed save/claim aborts work. Do not hold an uncommitted DB transaction
// across upstream I/O. Never expire/delete an unresolved payment's identity.
export interface PurchasePort {
  exclusive<T>(
    authorityId: string,
    purchaseId: string,
    work: (
      record: PurchaseRecord,
      save: (next: PurchaseRecord) => Promise<void>,
    ) => Promise<T>,
  ): Promise<T>
}

export type PurchaseView =
  | { kind: 'portone_sdk'; request: PortOnePaymentRequest }
  | { kind: 'complete'; order: { id: string; orderNumber: string } }
  | { kind: 'order_readback'; order: { id: string; orderNumber: string } }
  | { kind: 'needs_attention' }

export function purchaseWorkflow(
  config: { publishableKey: string; apiUrl?: string },
  store: PurchasePort,
) {
  // Dedicated guest client: do not inherit a signed-in customer's browser state.
  const { commerce } = createClient({ ...config, customer: { persist: false } })
  const run = <T>(
    authorityId: string,
    purchaseId: string,
    work: (
      r: PurchaseRecord,
      save: (next: PurchaseRecord) => Promise<void>,
    ) => Promise<T>,
  ) =>
    store.exclusive(authorityId, purchaseId, async (r, save) => {
      if (r.authorityId !== authorityId || r.purchaseId !== purchaseId)
        throw new Error('Purchase authority mismatch')
      return work(r, save)
    })
  const rememberCart = (r: PurchaseRecord, snapshot: Cart) => {
    if (
      r.cart &&
      (r.cart.snapshot.id !== snapshot.id ||
        snapshot.revision < r.cart.snapshot.revision)
    ) {
      throw new Error('Refuse mismatched or older Cart snapshot')
    }
    if (!r.cart) throw new Error('Missing Cart capability')
    r.cart.snapshot = snapshot
  }
  const requirePaidPath = (checkout: Checkout) => {
    if (
      checkout.status !== 'open' ||
      checkout.amounts.totalMinor <= 0 ||
      checkout.amounts.currency !== 'KRW' ||
      checkout.items.length === 0 ||
      checkout.items.some((item) => item.requiresShipping)
    ) {
      throw new Error('Outside configured nonshipping positive KRW path')
    }
  }
  const observe = async (r: PurchaseRecord): Promise<PurchaseView> => {
    const created = r.checkout?.result
    if (!created) throw new Error('Resume the stored Checkout request first')
    if (!r.payment) {
      const checkout = await commerce.checkouts.retrieve({
        checkoutToken: created.checkoutToken,
      })
      if (checkout.id !== created.checkout.id)
        throw new Error('Checkout identity mismatch')
      // Already placed is order readback, not proof about an unknown PSP attempt.
      return checkout.status === 'placed'
        ? { kind: 'order_readback', order: checkout.order }
        : { kind: 'needs_attention' }
    }
    if (!r.payment.result)
      throw new Error('Resume the stored PaymentSession request first')
    const payment = await commerce.paymentSessions.retrievePortOne({
      paymentSessionId: r.payment.result.id,
      checkoutToken: created.checkoutToken,
    })
    const placedCheckout = await commerce.checkouts.retrieve({
      checkoutToken: created.checkoutToken,
    })
    if (
      payment.id !== r.payment.result.id ||
      placedCheckout.id !== created.checkout.id
    ) {
      throw new Error('Purchase identity mismatch')
    }
    if (
      payment.providerStatus === 'captured' &&
      payment.finalizationStatus === 'committed' &&
      payment.reconciliation.status === 'none' &&
      placedCheckout.status === 'placed' &&
      payment.order.id === placedCheckout.order.id
    ) {
      return { kind: 'complete', order: placedCheckout.order }
    }
    if (
      placedCheckout.status === 'open' &&
      payment.reconciliation.status === 'none' &&
      payment.presentationStatus === 'actionable' &&
      payment.nextAction?.type === 'portone_sdk'
    ) {
      // Non-cancelable: retry only this exact request, never a sibling session.
      const action = payment.nextAction
      return {
        kind: 'portone_sdk',
        request: {
          storeId: action.storeId,
          channelKey: action.channelKey,
          paymentId: action.paymentId,
          orderName: action.orderName,
          totalAmount: action.totalAmount,
          currency: action.currency,
          payMethod: action.payMethod,
          redirectUrl: action.redirectUrl,
        },
      }
    }
    return { kind: 'needs_attention' }
  }

  return {
    async prepareCart(authorityId: string, purchaseId: string): Promise<Cart> {
      return run(authorityId, purchaseId, async (r, save) => {
        if (r.checkout || r.payment)
          throw new Error('Resume existing purchase; do not edit its Cart')
        if (!Number.isSafeInteger(r.intent.quantity) || r.intent.quantity < 1)
          throw new Error('Invalid quantity')
        if (!r.cart) {
          // carts.create has NO idempotency key. A lost result needs app support;
          // never replay this pending create as though it had the later contract.
          if (r.cartCreationStarted)
            throw new Error('Cart creation outcome unavailable; retain record')
          r.cartCreationStarted = true
          await save(r)
          const created = await commerce.carts.create({
            market: r.intent.market,
          })
          r.cart = { cartToken: created.cartToken, snapshot: created.cart }
          await save(r)
        }
        if (!r.add) {
          const result = await commerce.product.detailCatalog({
            slug: r.intent.slug,
          })
          if (!result.found) throw new Error('Product unavailable')
          const codec = createProductSelectionCodec(result.product, {
            emit: 'canonical-id',
          })
          const selection = resolveProductSelection(
            result.product,
            codec.parse(r.intent.selectionQuery),
          )
          if (!selection.selectedVariant)
            throw new Error('Choose a current variant')
          r.add = {
            request: {
              cartToken: r.cart.cartToken,
              expectedRevision: r.cart.snapshot.revision,
              idempotencyKey: crypto.randomUUID(),
              productId: String(result.product.product.id),
              variantId: String(selection.selectedVariant.id),
              quantity: 1,
            },
          }
          await save(r) // Atomic claim fixes key AND body before upstream.
        }
        if (!r.add.result) {
          const result = await commerce.carts.addItem(r.add.request)
          rememberCart(r, result.cart)
          r.add.result = result
          await save(r)
        }
        if (!r.update) {
          const line = r.cart.snapshot.items.find(
            (item) => item.variant.id === r.add!.request.variantId,
          )
          if (!line) throw new Error('Selected Cart line unavailable')
          r.update = {
            request: {
              cartToken: r.cart.cartToken,
              expectedRevision: r.cart.snapshot.revision,
              idempotencyKey: crypto.randomUUID(),
              cartItemId: line.id,
              quantity: r.intent.quantity,
            },
          }
          await save(r)
        }
        if (!r.update.result) {
          const result = await commerce.carts.updateItem(r.update.request)
          rememberCart(r, result.cart)
          r.update.result = result
          await save(r)
        }
        const latest = await commerce.carts.retrieve({
          cartToken: r.cart.cartToken,
        })
        rememberCart(r, latest)
        await save(r)
        if (
          latest.items.length === 0 ||
          latest.items.some((item) => item.requiresShipping)
        ) {
          throw new Error('Review Cart; this path requires nonshipping items')
        }
        return latest // Display server totals; no client-side Money arithmetic.
      })
    },
    async startPayment(
      authorityId: string,
      purchaseId: string,
    ): Promise<PurchaseView> {
      return run(authorityId, purchaseId, async (r, save) => {
        if (!r.cart || !r.update?.result)
          throw new Error('Prepare and review Cart first')
        if (!r.checkout) {
          r.checkout = {
            request: {
              cartToken: r.cart.cartToken,
              customer: { email: r.intent.email },
              idempotencyKey: crypto.randomUUID(),
            },
          }
          await save(r)
        }
        if (!r.checkout.result) {
          r.checkout.result = await commerce.checkouts.create(
            r.checkout.request,
          )
          await save(r) // Persist Checkout id/token before any provider handoff.
        }
        if (!r.payment) {
          const checkout = await commerce.checkouts.retrieve({
            checkoutToken: r.checkout.result.checkoutToken,
          })
          if (checkout.id !== r.checkout.result.checkout.id)
            throw new Error('Checkout identity mismatch')
          if (checkout.status === 'placed')
            return { kind: 'order_readback', order: checkout.order }
          requirePaidPath(checkout)
          if (checkout.paymentState.activePaymentSession)
            return { kind: 'needs_attention' }
          r.payment = {
            request: {
              checkoutToken: r.checkout.result.checkoutToken,
              idempotencyKey: crypto.randomUUID(),
              provider: 'portone',
              providerOptions: {
                profile: 'standard_v2',
                paymentMethod: 'CARD',
              },
            },
          }
          await save(r)
        }
        if (!r.payment.result) {
          r.payment.result = await commerce.paymentSessions.createPortOne(
            r.payment.request,
          )
          await save(r) // Persist PaymentSession id before the browser action.
        }
        return observe(r)
      })
    },
    async resume(
      authorityId: string,
      purchaseId: string,
    ): Promise<PurchaseView> {
      return run(authorityId, purchaseId, (r) => observe(r))
    },
  }
}